The FBI's Approach to the Cyber Threat - <AUTHOR> https://www.fbi.gov/news/speeches/the-fbis-approach-to-the-cyber-threat <comment><USER2> > One of my children described to me what our problem is in recruiting. She > said, "Dad, the problem is you're the man." I thought that was a compliment, > so I said, "Thank you, I really appreciate that." She said, "Dad, I don't > mean that in a good way. I mean you're the 'Man.' Who would want to work for > the 'Man'?" I think she's right. But I said to her, "You know, if people saw > what this 'Man' and 'Woman' of the FBI was like, and what we do, and the > challenges we face, I think they'd want to come work for us."

Given that even after his daughter explained the term to him, he still doesn't know that 'The' is part of the phrase, I'm not sure if The Director of the FBI knows what the phrase 'The Man' means...

<comment><USER3> This was when I decided to never work for the FBI:

[http://fortune.com/2015/04/06/fbi-agent-fitness- test/](http://fortune.com/2015/04/06/fbi-agent-fitness-test/)

It's important to note that this means handicapped people are no longer allowed desk jobs as analysts at the FBI. Missing a limb? You can't fight crime anymore!

That's not my primary concern, though, per se. My concern is that firing and disqualifying people who are otherwise talented MUST reduce clearance rates. It's can't NOT do that. If FBI employees looking fit is more important to Mr. Comey[1] than arresting murderers, I have absolutely no interest in his organization.

[1] "I want you to look like the squared-away object of that reverence," Comey wrote in a memo to agents. "I want the American people to be able to take one glance at you and think, 'THERE is a special agent of the Federal Bureau of Investigation.'" [http://www.vanityfair.com/news/2015/04/fbi-fitness- test](http://www.vanityfair.com/news/2015/04/fbi-fitness-test)

<comment><USER4> The FBI fitness test: hire people who have a higher statistical possibility of being narcissistic. (Wikipedia: "Narcissism is the pursuit of gratification from vanity or egotistic admiration of one's own attributes.")

Respect my authority. Bow and be reverent when I question you. Be glad I don't beat you to a bloody pulp right here when nobody is looking.

<comment><USER3> This sounds like way too much, but the sibling comment is a bit too little. Saying fatsos don't get a badge and a get a shittier title IS a deliberate status punishment. Reminds me of strong negative opinions I have about high school, where push-up ability translates into pecking order position.

Comey's statement does seem at least slightly vainglorious. He certainly has a high opinion of how the FBI should be viewed (exceeding, for instance, 'professional' or 'public servant's), and believes it should be obvious who FBI agents are, which will annihilate their undercover operations. So he is sacrificing a lot in order to get big(ger), dumb(er, due to firing and not hiring good investigators) jocks.

But I don't think it is meant to engender obedience or fear in civilians. I think it is just a Bad Decision.

</comment></comment></comment></comment><comment><USER5> The tri-letters seek more and more access to personal data, yet their own transparency worsens and their operations are increasingly classified or confidential, even to members of Congress. We have more reason to be concerned about the dark areas of government than Mr. Comey's "dark room" of civil privacy. Defending civil liberties is an uphill battle because their importance is not as immediately apparent as the security predicament of the day. On the other hand, once the government gains a new mandate and new authority it's rarely willing to relinquish this power once the cause for the mandate has been resolved or the solution demonstrated unworkable. So we should be cautious about granting broad authority to solve today's problems; we'll have to live with the consequences tomorrow and days to come even if it's realized the cure was worse than the disease.

<comment><USER6> The end game of government is all dark-room. Bills are written in secret by lobbying groups, treaties are negotiated and signed in secret, the TSA can arrest people through secret laws, more and more government lawsuits are in secret, we can withhold prisoners indefinitely in secret, the fact that a secret organization contacted you and demanded secret information is secret.

This isn't just TLAs, it's the entirety of government. Some bits and pieces are farther along than others, but it's all heading that way (same with local governments).

Edit: did I mention starting/conducting wars through secret re-interpretations of existing laws?

Edit 2: did I mention you can be prosecuted with secret evidence you and your lawyer aren't allowed to see?

</comment></comment><comment><USER7> Brought to you by the same agency you know and love who also gave you previous favorites such as " _Trying to Make MLK Jr. Commit Suicide_ " and " _Planning to Execute Occupy Protesters With Sniper Teams_."

<comment><USER8> In case anybody assumes these two accusations are too wild to be true, here are sources:

Sources:

[1] [https://en.wikipedia.org/wiki/FBI%E2%80%93King_suicide_lette...](https://en.wikipedia.org/wiki/FBI%E2%80%93King_suicide_letter)

[2] [https://en.wikipedia.org/wiki/Occupy_movement](https://en.wikipedia.org/wiki/Occupy_movement) [Paragraph #2 Under Lawsuits]

<comment><USER9> The FBI uncovered a plot to assassinate OWS leaders in Houston. Claiming that they were planning to do this themselves completely changes the story. [http://www.courthousenews.com/2015/02/06/fbi-gets-ok-on- alle...](http://www.courthousenews.com/2015/02/06/fbi-gets-ok-on-alleged- murder-plot-info-cache.htm)

</comment></comment></comment><comment><USER10> None of the threats they mention involve encryption much, not in the sense of the FBI having access to the content. Ransomeware and phishing attacks, which are the high-cost items now, don't need that.

Anti-terrorism might, but US terrorism today is a family affair. Since 2010, almost all US terrorism attacks have been by individuals. The Las Vegas shooting, Boston marathon bombing and the San Bernardino massacre were by family members. The Garland, TX shooting was three guys from Phoenix who lived together. In no case was any encrypted communication involved.

</comment><comment><USER11> > Even our memories are not absolutely private in the United States. Even our > communications with our spouses, with our lawyers, with our clergy, with our > medical professionals are not absolutely private. A judge in certain > circumstances can order all of us to testify about what we saw or remembered > or heard.

And that's a problem. Communications with spouses, lawyers, clergy and physicians ought to be absolutely privileged. The disadvantages of doing so are outweighed by the advantages.

Frankly, I don't think _anyone_ should be compelled to give testimony for the prosecution (I _am_ okay with the defense being able to compel testimony). If someone has knowledge of a crime, but disagrees that it should be a crime, he should be free to keep his mouth shut.

> It is seductive when I hear someone say, "Absolute privacy is the paramount > value. Our devices are designed to ensure that privacy is absolute in > America." Then, I stop and I step back and I realize, "You know, we've > actually never lived that way. That is a different way to live."

It's a _better_ way to live.

> That's criminals not caught, that's evidence not found, that's sentences > that are far, far shorter for pedophiles and others because judges can't see > the true scope of their activity.

That is a price to pay, but it is IMHO worth it, Those of us who support strong encryption shouldn't be disingenuous and deny that it exists; rather, we should be forthright about it.

Frankly, strong encryption is out of the bag. You can roll a secure cypher by hashing a key with 0, then 1, then 2, and XORing that stream with your message.

<comment><USER6> What's most frustrating is that every person that pushes for further intrusions and further dismantling of privacy and liberty hold themselves exempt for any number of reasons.

I'd also like to know where they draw the line? What's _too_ invasive? At what point _are_ they willing to (cringe) let pedophiles get lighter sentences, because a privacy intrusion is _too_ extreme? As we march ever forward down the road of always-on blanket surveillance, we might need to start asking this question so we know exactly how far elected leaders are willing to go (and if they believe themselves to be exempt from such intrusions).

</comment></comment><comment><USER12> Just a brief note for those coming late to this thread that this originally pointed to (and made it to the frontpage as) [1], which is a discussion of only the part of this speech by Comey which pertains to encryption and privacy, and which starts with "A brief word, because I can't resist, to talk about encryption", which you can grep for.

A basic summary, not using the same words: They want backdoors, and they propose that still counts as 'strong encryption', only, well, with a backdoor. Also, they intend to make a push for this next year.

[1]: [https://www.wsws.org/en/articles/2016/09/05/encr-s05.html](https://www.wsws.org/en/articles/2016/09/05/encr-s05.html)

</comment><comment><USER13> Having the director of a law enforcement agency wading so far in to public policy (and in a lot of ways _far_ beyond) seems odd to me, is this typical of the position, historically?

</comment><comment><USER14> This is one of the most disgusting and hypocritical things I've ever read. The level of doublespeak, fear-mongering and appeal to emotion is insane.

</comment><comment><USER15> > "First, we can reduce vulnerabilities. We in the government can equip you in > the private sector to understand actors and cyber criminals and their > techniques, their tactics, and their procedures." \- From [1]

I realize the alphabet soup agencies don't have much communication between each other, but isn't the NSA hoarding vulnerabilities? Doesn't that go against this "let's work together" shtick?

> "We have gotten good at minimizing your disruption, minimizing disruption > and pain to your employees, and protecting your privacy and your legitimate > concerns about competitive advantage. We will not share your data about > employees or operations. We will have adult conversations constantly with > you to tell you what we're going to do with the information you give us, so > that you can make risk-benefit decisions about what information to give us. > We will not allow you to be blindsided, because we understand that if we do > that, you're not going to talk to us anymore...We need to make sure you > understand how important it is to your competitive advantage to integrate > the FBI into your risk-assessment plan. You spend a lot of time, no matter > where your facility is, making sure the fire department has a basic > understanding of the layout your building, so that in the event of a > disaster they can save lives. I suggest you do the same with respect to your > cyber threat and your risk-assessment plan." \- From [1]

This is absolutely nuts. Assuming they're even true about "minimizing your disruption" \- which once they start they'll slam a gag order on you anyways so you can't even cry wolf about their "disruption" \- the parallel to the fire department is completely unfit. The FBI's interests are not aligned with yours, he even admits as much in the article! Furthermore, the role of the fire department, in the case of a fire, is to save as many lives as possible. The FBI's role in response to an attack is to not save your data, nor is it to save your business, it's to find and punish the actors responsible. The fire department doesn't go after the arsonist, they're there for a fundamentally different reason. Giving the FBI "backdoor" access is akin to letting the FBI be the judge, jury, and executioner in your case.

> "We believe in the FBI that we need a conversation. If at the end of the day > the American people say, "You know what, we're okay with that portion of the > room being dark. We're okay with"—to use one example—"the FBI, in the first > 10 months of this year, getting 5,000 devices from state and local law > enforcement and asked for assistance in opening them, and in 650 of those > devices being unable to open those devices." That's criminals not caught, > that's evidence not found, that's sentences that are far, far shorter for > pedophiles and others because judges can't see the true scope of their > activity." \- From [1]

That could also easily be 650 regular American citizens who've done nothing wrong. The absence of evidence is not evidence, and this argument bears a striking similarity to the "nothing to hide" argument.

[1]: [https://www.fbi.gov/news/speeches/the-fbis-approach-to- the-c...](https://www.fbi.gov/news/speeches/the-fbis-approach-to-the-cyber- threat)

<comment><USER16> > > "First, we can reduce vulnerabilities. We in the government can equip you > in the private sector to understand actors and cyber criminals and their > techniques, their tactics, and their procedures."

They are worse than useless at this. They actually have very little to offer in this area.

Just more lies and grandstanding.

<comment><USER17> There's a lot wrong with some of the things Comey said, but this simply isn't true.

Its a pretty common occurrence for a large company to find out that they've been hacked only when the FBI notifies them. There are small teams at the FBI that have a ton of experience dealing with enterprise intrusions.

</comment></comment></comment><comment><USER18> > The Sony attack was an attack aimed at free expression. It was the act of a > bully looking to silence speech in the United States, and around the world, > by intimidation and harassment, in that case, of Sony Pictures.

What? Can anyone provide me some concrete evidence that that's what the Sony attack was about? In the Wikipedia article on the event, I found this sentence:

> This followed a message that several Sony Pictures executives had received > via email on the previous Friday, November 21; the message, coming from a > group called "God'sApstls" [sic], demanded "monetary compensation" or > otherwise, "Sony Pictures will be bombarded as a whole". [1]

The key phrase I see here is _monetary compensation_ , not _silence of speech in the United States_. To me, Comey and the FBI (and of course the NSA, CIA, etc.) have a history of stripping the rights of citizens to protect America. Everything in this speech leads me to believe that that is continuing to happen.

I just hope that the strategic footholds we gain are worth the costs we pay as citizens.

1\. Seal, Mark (February 4, 2015). "An Exclusive Look at Sony's Hacking Saga". Vanity Fair. Retrieved February 4, 2015.

<comment><USER9> An email to the Sony Pictures from the GoP said it was about The Interview, which makes sense. It was the only movie that GoP obtained that they didn't release. [http://money.cnn.com/2014/12/19/media/insde-sony-hack- interv...](http://money.cnn.com/2014/12/19/media/insde-sony-hack- interview/index.html)

</comment></comment><comment><USER19> > We are not to bean bags and granola and a lot of white boards yet. But we're > working very hard at marching in that direction

[https://cdn.meme.am/instances/500x/71522909.jpg](https://cdn.meme.am/instances/500x/71522909.jpg)

</comment><comment><USER20> All he is doing is helping the "stack" win. With weaker encryption and weaker security it puts the very thing he is trying to protect at further risk.

"Victory at the expense of the innocent, is no victory at all."

\-- King T'Chaka of Wakanda

</comment><comment><USER2> It seems to me that be most bang-for-buck way the FBI could counter the cyber threat is to contribute security reviews and patches to popular open-source software. "Get paid full time to do security patches for Open Source" seems like a good recruiting call as well.

In a round-about way, this letter indicates that they are doing some of that. But, I'm not clear how much.

<comment><USER21> That's not their role, though. _Someone_ has to be actively tracking and apprehending hacker groups operating within the US.

Sure, they can find and help fix holes, but the US needs a government organization tracking cyber threats, and stopping them when they can.

</comment></comment><comment><USER22> Do we have a better source than the "World Socialist Web Site"?

<comment><USER23> This is the actual text of his speech:

[https://www.fbi.gov/news/speeches/the-fbis-approach-to- the-c...](https://www.fbi.gov/news/speeches/the-fbis-approach-to-the-cyber- threat)

I must admit, I'm impressed the old stalinist organisations are still being funded. That's almost making his point for him.

<comment><USER9> It's Trotskyist, not Stalinist, but yes, primary sources are preferred, especially when they're short and self-contained as in this case.

<comment><USER23> I stand corrected, thanks. Is there any way to know where they're getting their funding from? I poked around a little but couldn't find anything.

<comment><USER24> The WSWS is published/funded by the ICFI, and appears to solicit and accept public donations. Here's what Wikipedia has to say on the ICFI:

[https://en.m.wikipedia.org/wiki/International_Committee_of_t...](https://en.m.wikipedia.org/wiki/International_Committee_of_the_Fourth_International)

</comment></comment></comment></comment></comment><comment><USER25> And this is the problem with choosing lesser evils.

<comment><USER26> The other option is to choose the greater evils, right? There's a choice to be made: pick the lesser or greater evil.

<comment><USER25> No the other option is to pick a good option. Rather than accepting corruption and cronyism.</comment></comment></comment>


Objective-Curry - <AUTHOR> http://www.sicpers.info/2015/02/objective-curry/

<comment><AUTHOR> "ARC works wonders when you try to write Java in Objective-C, [..]. It isn't so helpful when you try to write Objective-C in Objective-C."

Gold!</comment>


AI can help spot coding mistakes before they happen - <AUTHOR> https://www.technologyreview.com/the-download/610416/ai-can-help-spot-coding-mistakes-before-they-happen/ <comment><USER2> So is this basically a fancy way to say 'ubisoft uses linting'?

</comment><comment><USER3> Fluid AI, a Boston based startup is considering taking a similar approach (currently implemented as an IntelliJ plugin) to ethereum smart contract IDE's.</comment>


What is Time? (An Entrepreneur's Definition of Freedom) - <AUTHOR> http://mindfulentrepreneur.com/blog/2007/08/27/time-is-freedom-for-entrepreneurs/

<comment><USER2> Didn't Paul write something along these lines as well? I've read something similar that was more fleshed out... Anyone know what it was?</comment>


GroupMe: Split the Bill - <AUTHOR> http://blog.groupme.com/post/44796541529/groupme-4-1-just-in-time-for-our-third-straight <comment><USER2> Maybe I'm just not as social as other people, but bill splitting and chipping in has never been a problem for me. Ever. On a handful of occasions I've had someone in a group I was in say they were strapped, and I've covered their portion of something. Others have done the same for me. Someone buys lunch for me if I have no cash, I get their lunch next week.

Buying a gift in an office for someone? Well, I've not worked in an office for a while, but cash used to work well (and didn't leave a digital trail of who you're giving money to).

Maybe there's some bigger play going on in this market, but it's always felt to me like a solution looking for a problem.

EDIT - on the few occasions where I've 'split a bill' with someone out at a bar/club/restaurant, I always feel I get stiffed, because I don't drink alcohol - so getting a $100 bill split 5 ways... well... I just had a $3 pepsi - why the hell do we "split" this equally?

<comment><USER3> I feel that. We can be old geezers together. We've had a solution to this "problem" for centuries: cash.

If your group is too lazy to ask the server to split the tab 4 ways, what in the world makes you think they're all going to pull out their apps and pay this way? Then there's inevitably someone who doesn't have a smartphone, or doesn't have that app, or doesn't want to sign up for a new payment account, or doesn't like using credit cards online, or whatever.

More than a couple times I've been sitting there with people trying to add up their totals, some taking out cash, some taking out cards, arguing over who pays what, and just paid the whole thing and asked them to buy me coffee or a meal or whatever when they can.

<comment><USER4> With restaurant bills, things get rather complicated when everyone orders different items, someone bought a Groupon, etc. Unless people are OK with over/under paying, a bill splitting app can be pretty useful to figure out what everyone actually owes.

Cash works well when everyone has it, but from what I've seen that doesn't happen all that often. Also, you get a lot of restaurants that refuse to itemize the bill (maybe their point of sale system doesn't support it), and sometimes they'll only take 1 credit card. Integration with payment apps is great for that. It goes beyond saving time...an app can help make sure people pay up and the IOUs don't become permanent.

Disclosure: I recently released Grouptuity (<https://play.google.com/store/apps/details?id=com.grouptuity>), which tries to solve these problems and integrates with Venmo.

<comment><USER2> Usually, there's a minimum charge ('gratuity') for parties of 6 or 8 or more, so they better damn well split the bills for us. I've had it be a problem _twice_ in the past 6 years of dining out, and once was sort of my own doing (we had a party of 24 on a Friday night - I just paid it as a single thing vs having everyone split it up - it was an unusual event). The other time it happened was a party of 5 and the server refused to split up the bill. We all chipped in something, but I don't go back there anymore.

Maybe it's a bigger problem in some areas of the world, but not mine.

</comment></comment></comment></comment><comment><USER5> This seems unreasonably expensive. Each contributor gets charged 4% plus $0.99. This makes it very expensive to split a restaurant lunch bill.

8 people chipping in on a $100 check: Even split would be $12.50 per person. With this service it would be $14.00 per person. That's a 12% tax on lunch for everyone but the initiator.

This might be useful for bigger purchases, but even then, charging 4% to give money to my friend seems a little ridiculous.

</comment><comment><USER6> I love that they're trying this, and it seems to be executed well.

My friends and I already use Venmo for bill splitting though, and it works pretty well.

Generally I subscribe to the school of thought that each app should do one thing and do it well, and this is sort of unfortunately getting away from that.

</comment><comment><USER7> This will never work with a 4% fee. Never.

</comment><comment><USER8> Just a data point from one person's experiences:

I feel like check splitting is always a bigger problem for the restaurant/server than it is for the people paying. All the customers need to do is pull out a credit card. It's the server that actually has to split the bill and you can always see the discomfort on his/her face when you ask them to split it AFTER they give you the check. Just let them know before ordering that you'll be needing separate checks.

The example on the site seems like a better use case, but the marketing copy "split the bill" immediately makes me think of a restaurant or bar tab which I don't regard as a problem.

<comment><USER9> If it's really a persistent problem for servers, maybe they should think about asking themselves in advance of taking the order.

<comment><USER10> Doesn't work that way, the default method--by far--is one check. So they'd annoy and possibly offend, say, 98 people out of 100 when the 2 or so that are splitting the check can say so before ordering.

</comment></comment></comment><comment><USER11> One of the biggest lessons I've learned building matchist so far (<http://matchist.com/talent>) is that there is a delicate balance between when my opinion is king and when data is king.

In my opinion, GroupMe isn't solving a problem with this feature (for many of the reasons others have commented on here). But I'm assuming GroupMe has a good amount of data proving that this problem exists. I sure hope they do, because in this case, data should absolutely trump their opinion of whether or not this is a problem to be solved.

</comment><comment><USER12> The fee is the killer, especially when you're in competition with PayPal's ability to pay friends for no fee when funded through a bank account.

</comment><comment><USER13> "How much does it cost? Per transaction, contributors will be charged 3.5% on whatever they chip in for a Credit Card Processing Fee. GroupMe charges a .99 convenience fee."

They also state that they are using Balanced Payments to process the payments, which charges 2.9% + 30c per payout (and additional 25c per deposit). I'm skeptical that users would even be willing to pay this rate...

</comment><comment><USER14> I eat in large groups often and we only split evenly on occasion. It almost always never happens. To charge per transaction makes this even less useful (to me in particular). I personally find something like Venmo much more practical where one person fronts the bill (and gets rewards/points) while the rest Venmo what they owe on the spot. It's never a fair even split.

</comment><comment><USER15> Bill sharing has been a hassle for me since I have two roommates, but I've been using Splitwise without any complaints. From the looks of it, this is taking the group SMS approach, which I would find overwhelming. I get e-mails whenever bills are added and that's good enough for me. Nice work on the UI, that was the first thing I noticed.

</comment><comment><USER16> Great functionality, but the 4% fee is way too high, considering we are talking about giving money to a friend.

</comment><comment><USER17> I think this functionality (mobile first, crowd funding / group payments) could quickly become a more important feature than the group texting.

Great work.

<comment><USER18> Really?

Is it too hard to ask for separate checks or figure out Basic Dining 101? Call me an old fart, but when I read about apps like this I want to do my Samuel L. Jackson imitation and say; "Arithmetic, m-----f-----, can you figure it?"

</comment></comment><comment><USER10> What's the problem that this is solving? Paying friends with credit cards isn't the way to go. Cash, if you don't have this week (it happens) I'll /you'll wait for a week or x weeks.

People hang with people with similar values so it's extremely rare for friends to screw friends and when that happens, it happens once.</comment>


Who needs work-life balance? - <AUTHOR> http://blog.penelopetrunk.com/2015/08/19/what-life-would-look-if-we-said-no-to-work-life-balance-and-a-nod-to-amazon-of-course/ <comment><USER2> There are those of us who worked under these A-player only regimes, and have had our fill of them.

They'll have to recruit younger and/or more gullible or financially hungry candidates, who are willing to burn the candle at both ends.

Those who have worked in this environment for a number of years usually don't want to experience it ever again.

Maybe if you can sustain this A-player workload forever, you might be better off becoming a founder starting your own company. For a lot of us, we just don't have that kind of drive (at least, not after a few years at an A-player only company).

</comment><comment><USER3> > People should pay a premium for a regular paycheck.

How is at-will employment a guaranteed regular paycheck?

I won't even address the nonsense of working 20 hours a day, while countless studies have proven that this causes more harm than good.

</comment><comment><USER4> This stupid attitude is the reason why vacations should be mandatory.</comment>


The global language network and its association with global fame - <AUTHOR> http://www.pnas.org/content/early/2014/12/11/1410931111 <comment><AUTHOR> Direct link to report PDF: [http://www.pnas.org/content/early/2014/12/11/1410931111.full...](http://www.pnas.org/content/early/2014/12/11/1410931111.full.pdf)</comment>


Why we're excited about Mailbox getting acquired by Dropbox - <AUTHOR> http://squareonemail.tumblr.com/post/45434884484/why-were-excited-about-mailbox-getting-acquired-by

<comment><USER2> The SquareOne approach to having email being presented in a birds-eye dashboard will change the way people approach email reading and management. With Dropbox acquiring Mailbox it shows that there is an email problem that needs to be solved.

</comment><comment><USER3> The fact that e-mail has become so cumbersome is drawing several people into the field of trying to make some sense out of it; SquareOne seems to have a pretty good system, from what I have seen. it will be interesting to see what comes of this merger.

</comment><comment><USER4> Love this acquisition. Should be a huge lift for both companies. I'm excited about the SquareOne approach to email presentation. I've been a long time customer of Mailbox

</comment><comment><USER5> I'm with wasabiventures on this. The SquareOne method of categorizing your emails, similar to the psychological processes we use everyday, is a superior email management approach. This will solve the email problem facing many individuals.</comment>


What future headline do you predict? - <AUTHOR>

<comment><USER2> Wyoming Joins Texas as Second State to Issue Own Currency In Wake of U.S. Dollar Collapse

Following Dennis Rodman Visit, Switzerland Declares War on U.S.

Bloomberg Bans Bottled Water: Claims It Robs Our "Precious Bodily Fluids"

Patent Troll Claims Rights to Inhalation of Air - Demands Licensing Fees From All Breathers

</comment><comment><USER3> "Outrage as pedestrian killed by self driving car"

<comment><USER4> "90% of car accidents caused by self driving system errors."

</comment></comment><comment><USER5> "155 year old sentenced to juvenile detention for tampering with town's singularity machine"

</comment><comment><USER6> Google Glass banned in McDonalds.</comment>


Show HN: Terrarium.js programming game - Sharpen your javascript skills - <AUTHOR> http://terrariumjs.wiselabs.net/

<comment><AUTHOR> I developed this last week, it is a port from the .NET old Terrarium game that Microsoft used to run.

Note: the blue ball will randomly teleport critters to other terrariums.

Try at least to beat the default carnivor!

</comment><comment><USER2> I'm getting an error on page load in application.js in the latest release version of Chrome.

Uncaught SyntaxError: Variable 'a' has already been declared

<comment><AUTHOR> Really? When you just load the page or when you push some code in?

<comment><USER2> Just loading the page. I tried it in Firefox and it works fine. Exact Chrome version is 21.0.1180.89.</comment></comment></comment>


Solar reactor may enable clean hydrogen fuel derived from sunlight - <AUTHOR> http://www.udel.edu/udaily/2012/apr/solar-reactor-040312.html

<comment><USER2> Hydrogen?</comment>


Former Tesla employee admits uploading Autopilot source code to his iCloud - <AUTHOR> https://www.theverge.com/2019/7/10/20689468/tesla-autopilot-trade-secret-theft-guangzhi-cao-xpeng-xiaopeng-motors-lawsuit-filing <comment><USER2> I wonder why he was allowed to install and setup his private iCloud access on a corporate laptop? And if that somehow is allowed, then that machine should not have access to the IP of the company.

This is normal corporate practices since the 90s, and if you want to protect your information, you need to follow it. From a Dev / Sysadmin side it can suck having IT dictate whats allowed to be installed, but those practices are there for a reason.

</comment><comment><USER3> At what point do you just not hire Chinese nationals (aka, those who maintain current Chinese citizenship.)?

</comment><comment><USER4> It's unfortunate that China just doesn't give a crap about IP rights.</comment>


Revealed: The Secret KGB Manual for Recruiting Spies - <AUTHOR> https://www.thedailybeast.com/the-kgb-papers-how-putin-learned-his-spycraft-part-1?ref=author <comment><USER2> One of the most distressing (of many) elements of this is way disinformation has been ramped up and feeds into the unwillingness of many to "consider the facts".</comment>


Eric Schmidt calls for regulation of mini-drones - <AUTHOR> http://www.bbc.co.uk/news/technology-22134898

<comment><USER2> _"How would you feel if your neighbour went over and bought a commercial observation drone that they can launch from their backyard. It just flies over your house all day. How would you feel about it?"_

Well to throw Mr. Schmidt's own words right back at him, you could "just move".

[http://www.huffingtonpost.com/2010/11/04/google-ceo-eric- sch...](http://www.huffingtonpost.com/2010/11/04/google-ceo-eric-schmidt- privacy_n_776924.html)

"Google CEO Eric Schmidt's Most Controversial Quotes About Privacy"

</comment><comment><USER3> It's disappointing that the chairman of Google is resorting to this kind of fear-mongering. Spying on neighbors all day long? Terrorism? Come on now.

Meanwhile, he explicitly mentions that it's not a problem for Government use and I'm assuming he is implying that no regulation is needed for commercial use either.

Is he not concerned about all the data access on my neighbors that maps/earth/street view/google glasses provides?

Seems like this is more of a defense on Google's business model and or authority power, rather than a concern for society.

</comment><comment><USER4> meanwhile, google also urges everyone to use google glass. much easier than flying in ur friends bedroom!

id also point out that commercial uavs: (as in stuff citizens can buy)

\- dont carry weapons

\- dont fly more than 15min for stationary uavs (multi-rotors) due to current battery technology

\- "nobody " cares about what their neighbors are doing.. and when they do, they dont need an uav to film their garden.

i believe most of the scare is commercial, such as aerial street mapping, much cheaper via uavs than with google cars, for example - thus accessible to everyone

</comment><comment><USER5> You should accept that he is 'almost' right. It's true that this technology (as most of them) can be used for spying and terrorist purposes, but regulation is the worst (and most anti-competitive) way of handling this issue. The article does not mention what kind of regulation, though.

One would expect the chairman of a company whose motto was "don't be evil" to ask for awareness and education on the technology instead of regulation.

</comment><comment><USER6> Instead of government regulation, why not let the free market take care of this with personal anti-mini-drone countermeasure products?

</comment><comment><USER7> I wouldn't worry about the privacy aspect - an indeed Google Glass is much more of a worry in this sense.

But AFAIK drones are already being used to carry things into prisons and over borders. I really hope terrorists don't start using them.

</comment><comment><USER8> Oh, but use our Google Glass. Record everything you see on the way. Don't watch/record a couple kissing on the bridge. You recorded it? Uhh..hh.. well, upload on YouTube anyway, it's not that bad.

Hypocrisy. Hypocrites.</comment>


How a Microsoft Font Brought Down Pakistani Prime Minister Nawaz Sharif (2017) - <AUTHOR> https://www.theglobeandmail.com/news/world/how-a-microsoft-font-brought-down-pakistani-prime-minister-nawaz-sharif/article35828938/ <comment> sjm-lbm The scandal wasn't near as big, but a similar issue arose during the 2004 US Presidential election. Documents claiming to be from the early 1970s about George W Bush's air national guard service were found to use things like proportional-width fonts - and, indeed, the entire document seems to have just been typed using the default settings for a contemporary version of Word.

Here's some details: [https://en.wikipedia.org/wiki/Killian_documents_controversy](https://en.wikipedia.org/wiki/Killian_documents_controversy)

<comment><USER3> The letters were short, so someone could easily have retyped them in Word. Did anyone old enough to have used a typewriter seriously claim they were photocopies of 70s era typewritten documents? Surely Dan Rather of all people must have some experience with typewriters.

<comment><USER4> Yes, on air Dan Rather did in fact claim they were taken directly from Killian's files and had been 'authenticated'. The person who sent them to 60 Minutes also claimed they were originals, which he subsequently burned after faxing.

CBS then spent the next couple of weeks in a 'strident defense' (their own investigators' words) of the documents and their use, before ceding they screwed up and firing people over the incident.

[1] [https://en.m.wikipedia.org/wiki/Killian_documents_controvers...](https://en.m.wikipedia.org/wiki/Killian_documents_controversy)

<comment><USER5> Culturally, this to me is a turning point of the political bloggers -- the knee in the curve of their credibility and a large drop in the trust of the news media, particularly among conservatives.

The blogs leading the document debunking were Powerline and Little Green Footballs.

This was also when the term Pajamas Media was coined (quote from wikipedia PJ_Media page):

> The network's original name was derived from a dismissive comment made by > former CBS news executive Jonathan Klein during the 2004 Killian documents > affair: "You couldn't have a starker contrast between the multiple layers of > checks and balances at 60 Minutes and a guy sitting in his living room in > his pajamas."

I followed the whole thing closely at the time -- it was a bit surreal.

<comment><USER6> That whole ordeal seems so quaint now, in retrospect. I wonder if this happened in today's day and age, CBS would have anticipated that the twitter gonzo journalism class would rapidly attempt to identify flaws in the doc and vet it harder?

<comment><USER7> it was their, the traditional media, wake up call. it also forever broke the belief that the media was impartial. remember that while Rather and Mapes brought this shameful act of reporting we got to witness the New York Times go full Onion with a "fake but accurate" declaration.

Could it happen now? Not as blatant but I simply believe they have changed to simply relying more on innuendo and unidentifiable sources.

</comment></comment></comment></comment></comment></comment><comment><USER8> Pakistan acted on the Panama papers is a big news since a lot of countries with allegedly a hard stance against corruption did not.

<comment><USER9> It was mostly due to the efforts of one man, Imran Khan.

<comment><USER10> Yep. Hopefully he wins the current elections. Me and my whole family waited hours in lines to vote for him last elections.

<comment><USER11> Hypothetically speaking, what will your reaction be if he loses this time too? Will you (personally) accept his defeat and wait for the next election or will you take to the streets and protest against the election results like 2014 (given Khan calls his supports out)?

I am only trying to get the feel of Pakistani politics here, no personal bias.

<comment><USER12> Unlikley as all the other major parties have got their hands tied currently I am more worried about what happens when he goes against the army will he able to or will an army dictator rise again.

</comment></comment></comment></comment></comment><comment><USER13> It's like watching a movie set in the 1950s and noticing someone in the background walking past with his head looking down at a smartphone.

<comment><USER14> Like this Charlie Chaplin 1928 movie, with a time traveler talking into a cell phone walking by?

[https://www.youtube.com/watch?v=nU_k4yGPeOI](https://www.youtube.com/watch?v=nU_k4yGPeOI)

<comment><USER15> Good luck getting cell reception in 1928 :)

</comment></comment></comment><comment><USER16> If it was released in beta of longhorn in 2004 couldn't they have still legitimately created the doc???

<comment><USER16> [https://www.dawn.com/news/1344685](https://www.dawn.com/news/1344685)

> In a separate email, de Groot, the font designer himself, said that while in > theory it would have been possible to create a document using Calibri in > 2006, the font would have to be obtained from a beta operating system, "from > the hands of computer nerds".

> "Why would anyone use a completely unknown font for an official document in > 2006?" he went on to question.

> "If the person using Calibri was such a font lover that he or she had to use > the new Calibri, then he or she should be able to prove that other documents > were printed with Calibri in 2006, and these prints should be in the hands > of other people as well," he wrote.

> De Groot said in his opinion the document signed by Maryam Nawaz was > "produced much later, when Calibri was the default font in MS Word".

So apparently yes it would be possible but highly unlikely.

<comment><USER17> Having dealt with so many Pakistani web/graphic designers and photo retouchers back then, I don't think it is highly unlikely at all.

There was such a competitive race to the bottom with graphic design work that I could have seen the Prime Minister's son, daughter or anyone in their network having had that font on their computer.

At the time of this trial, I always had to laugh about the argument and wondered if I could present this reality as a third party to the trial, but then I saw that like every Pakistani Prime Minister is brought down this way and realized it has no bearing on my life whatsoever.

<comment><USER18> Then, as Carter wrote, it must be easy to find documents by one of them also using Calibri.

<comment><USER17> _shrugs_

Honestly I have never seen any drama from Pakistan that matched my expectations of due process.

The rebuttals and speculation are mildly entertaining, and the finality of their court garners no respect from me either way.

If the whole case hinged on the font actually existing in the wild in some capacity but the probability that it was on someone's computer at that point in time, yet some obvious to me possibilities were never even brought up, then all I can say is "lol, Pakistan."

</comment></comment></comment></comment></comment><comment><USER19> Curious how/who noticed the font detail and knew enough that it could help date the document.

However, couldn't the machine identification code from the printer reveal exactly when the document was printed?

<comment><USER9> It was identified by the JIT (join investigation team) established by the supreme court to look at the case. And Robert W. Radley of London-based The Radley Forensic Document Laboratory was the person who helped in identifying it.

Source: [https://www.dawn.com/news/1344654](https://www.dawn.com/news/1344654)

</comment></comment><comment><USER20> Almost every printed document also have hidden yellow dots that allows you to get certain information about that document (print date, print model etc...)

<comment><USER21> Even monochrome printers?

</comment></comment><comment><USER22> This may not amount to much for Pakistani people. The forces and judiciary are so pathetically weak that they couldn't force the PM and his Daughter and his sons to remain inside of Pakistan - so what if the PM's wife is sick in London (which we don't even know if it's true) - let her die alone because she and her life is worthless for Pakistani people. For months the PM's daughter barked daily in front of masses against the judiciary yet received full security protocol and no judge's order was put forward to muzzle her rabid speeches.

And then there is the magical softening of stance overnight and miracle reduction of punishments which Pakistani judges are famous for - <USER2> joke. I won't be surprised at all if at the end of day, all he gets is a 'warning' and 'stern lecture'.

Finally, PM in question and his family aren't the only corrupt folks in Pakistan - the other 'dynasty' is the PPP-clan of Bhuttos/Zardaris -- now watch them flee scotch-free from Pakistan.

And the icing on cake - UK/UAE/Swiss are among nations which actively harbor corrupt and dangerous Pakistani individuals, have granted them/their families citizenship, and allow them to bring their illegal wealth - these Govts will not send the wealth or the individuals back to Pakistan. Perhaps Pakistani ISI should learn from Israel's Mossad.

<comment><USER23> Slightly offtopic, but this [1] is a great series of podcasts about the assassination of Benazir Bhutto. No idea if she would have made a good leader, but she was certainly brave. Even if you're not interested in Pakistani politics, it's still fascinating.

[1] [https://www.bbc.co.uk/programmes/p05r6cgx/episodes/downloads](https://www.bbc.co.uk/programmes/p05r6cgx/episodes/downloads)

<comment><USER10> What do you mean no idea. She was PM several times in the 1990s and not a good one. She and Nawaz took turns robbing Pakistan until Musharraff came.

</comment></comment></comment><comment><USER24> That's really funny. Don't think I've ever seen Calibri on any legal document now that I think of it.

<comment><USER25> They should have used Comic sans. Released 1994.

<comment><USER12> There a saying in Urdu (Pakistani Language) Nakal ke liye Bhi Akal Chaye i.e Even to cheat you need brains.

</comment></comment></comment><comment><USER26> More coverage of today's court proceedings:

[https://www.dawn.com/news/1418326/guilty-nawaz-10-years- in-j...](https://www.dawn.com/news/1418326/guilty-nawaz-10-years-in-jail- maryam-7)

[https://www.geo.tv/latest/201862-avenfield-reference- verdict...](https://www.geo.tv/latest/201862-avenfield-reference-verdict- against-nawaz-sharif-family-at-3pm-now)

</comment><comment><USER27> Discussion from about a year ago:

[https://news.ycombinator.com/item?id=14751358](https://news.ycombinator.com/item?id=14751358)

</comment><comment><USER26> BTW, Avenfield reference case verdict has just been pronounced. Literally few minutes ago: Nawaz gets 10 years!

<comment><USER28> Good. Corruption needs jail time, not just fines.

<comment><USER29> Only if the same standard is held to everyone. I don't know any details about this case nor pakistans situation in general, but I know that in most corrupt states, corruption trials are usually used in a power struggle, where one corrupt side brings down the other side, and just has their own corpses better buried and/or is connected better to the investigators/secret intelligence.

<comment><USER30> Eh, better the powerful bringing each other down than united against the people.

<comment><USER29> Hm, but it is not like the evil powerful ones would go away this way. Besides, I don't mind "the powerful" per se. What matters to me is what people do with their power. Whetter it be much power or little. Also with little power you can do bad things.

So I like a fair trial for everyone, no matter the power/money.

</comment></comment></comment></comment></comment><comment><USER26> Looks like that Zardari is next: [https://www.dawn.com/news/1418348/eminent- banker-and-zardari...](https://www.dawn.com/news/1418348/eminent-banker-and- zardari-aide-hussain-lawai-taken-into-custody-by-fia-reports)

Hussain Lawai - Zardari's personal banker. There can't be anybody with more dirt on "the Beast" than him.

</comment><comment><USER26> Pretty much live coverage of that for the last hour: [https://www.youtube.com/watch?v=IQu5n7Nh42Y](https://www.youtube.com/watch?v=IQu5n7Nh42Y)

Given the channel is pro PTI, half of it is about Imran's people rawing hard on the streets.

</comment><comment><USER31> I've been following this case from the beginning. I think in a country like Pakistan it's a huge accomplishment! Pakistan is known for its corrupt leaders because they control the system inside out this is probably the first time law is being upheld and people are backing it.

<comment><USER32> It's not over yet. The person is still in London.

</comment></comment><comment><USER11> Here's another one. This guy spent 2.6 million Rupees on tea and biscuits. With the bill of bakery items for one TV channel's interview team being 175000 Rupees.

[https://www.thenews.com.pk/archive/print/641087-kp-cm- spends...](https://www.thenews.com.pk/archive/print/641087-kp-cm-spends- rs2.6m-on-entertainment,-bakery-items)

[https://www.urdupoint.com/en/pakistan/bill-of-tea- provided-b...](https://www.urdupoint.com/en/pakistan/bill-of-tea-provided-by- pervez-khattak-to-jir-389727.html)

</comment><comment> J-Kuhn tl;dr: Forged document claims to be from 2006, uses a font (Calibri) that was introduced 2007. Newsletters headline: "Sans Sharif".

<comment><USER33> With a name like that how can you not make the pun :)

</comment></comment><comment><USER34> Would using the hidden printer tracking dots/stenography also work to disprove the documents age?

</comment><comment><USER35> Microsoft bought a pirate Arabic font because they would not pay the orginal owner- Boutros Fonts, his asking price, and got away with it.

</comment><comment><USER36> Pakistan is not a democracy, it is run by the military regardless of who is in power, the ISI it's it's real head of state, which have a pro-islamist agenda but with a slightly modern outlook for economic growth. Regardless if he did any wrongdoing, there have been far worse acts by politicians in Pakistan and they have got away with it.

<comment><USER37> That may have been true a few decades ago, but it's certainly becoming more democratic.. still not the best, though. Especially with the military curb circulations of a private national newspaper.

<comment><USER26> Attack on Dawn and Geo were first of a kind after 5 years lull.

In last 5 years, Pakistan saw, well, nothing less than an explosion in privately owned press and TV channels.

<comment><USER10> Not last 5 years. That was mostly under an actual dictator Perviz Musharraff. That period was more democratic than after him which removed all power for local governments and probably more censorship/bans by PEMRA, our media regulatory agency.

I think people are too quick to judge other countries through their lens.

This is as true for some of us Pakistanis judging to the west through our cultural lens.

<comment><USER26> >This is as true for some of us Pakistanis judging to the west through our cultural lens.

Am I? Well, media curbs were then and now, but have you noticed a very apparent change in tone?

Yes, there were already quite a few private medias by late Musharaf, but back then news section was nearly the same all across them. Aside from the usual aha, aha, nod, nod, in news coverage of the junta, they just varied in kinds of entertainment content.

But once Mush was gone, it was only then for the first time in decades that news became somewhat resembling what they are supposed to be.

</comment></comment></comment></comment></comment><comment><USER38> Haha! Sans Sharif indeed!</comment>


Apple releases OS X Mavericks 10.9.2 with SSL fix - <AUTHOR> http://9to5mac.com/2014/02/25/apple-releases-os-x-mavericks-10-9-2-with-facetime-audio-contact-blocking-mail-fixes/ <comment><USER3> This bug was pretty serious. I'd better be extra careful and install and verify this myself.

Oh, good: there's a standalone installer available ([http://support.apple.com/kb/DL1726](http://support.apple.com/kb/DL1726)). But the download is served over HTTP. Maybe I can just try the same URL with HTTPS:

      $ curl --head https://support.apple.com/downloads/DL1726/en_US/OSXUpdCombo10.9.2.dmg
      HTTP/1.1 302 Moved Temporarily
      Server: Apache/2.2.24 (Unix)
      Location: http://download.info.apple.com/Mac_OS_X/031-3279.20140225.Zzasf/OSXUpdCombo10.9.2.dmg

Nope. Well, at least I can verify the SHA1 sum displayed on the download page. Wait, no, that was served over HTTP, too.

Okay, I'll follow Apple's instructions for checking the certificate fingerprint in the installer ([http://support.apple.com/kb/ht5044](http://support.apple.com/kb/ht5044)). But that page (Last modified November 2011) displays _a different fingerprint_ (9C864771 vs FA02790F)...and that fingerprint was _also_ served over HTTP.

 _Gives up and opens the App Store._

<comment><USER4> The packages themselves are signed: Mount the .dmg file and use pkgutil --check-signature /path/to/Installer.pkg to check whether the package is signed by a valid CA (if you want to be totally sure, do this check on a machine running 10.8 or earlier)

<comment><USER5> FWIW, I did this for the combo update. The SHA1 checksum on the Apple page, c06a63982b522e43997a05cedc04b0bdb1a10207, matches the file, and pkgutil reports

       Package "OSXUpdCombo10.9.2.pkg":

       Status: signed Apple Software

       Certificate Chain:
        1. Software Update
           SHA1 fingerprint: 1E 34 E3 91 C6 44 37 DD 24 BE 57 B1 66 7B 2F DA 09 76 E1 FD
           </comment></comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>-----

        2. Apple Software Update Certification Authority
           SHA1 fingerprint: FA 02 79 0F CE 9D 93 00 89 C8 C2 51 0B BC 50 B4 85 8E 6F BF
           </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>-----

        3. Apple Root CA
           SHA1 fingerprint: 61 1E 5B 66 2C 59 3A 08 FF 58 D1 4A E2 24 52 D1 98 DF 6C 60

</comment><comment><USER6> Forgive me, but I'm not really sure why this is getting so much attention.

It's certainly a bad bug, and it ought to have been caught. But it feels like this would be much harder to exploit than many other bugs which have had far less hoopla.

As I understand, this SSL bug makes it rather trivial to perform MITM attacks against apps which use the default system SSL libs.

That's certainly a problem, but most people are using trustworthy ISPs (at least in this sense). Comcast seems unlikely to try to steal your bank password, and Verizon is unlikely to try to harvest your HN cookies.

It seems like this primarily affects people connecting to untrustworthy access-points, such as Coffee Shops, or Airport Wifi - While that's certainly something that needs to be fixed, it seems far less crucial than remote-code- execution [1], or many other bugs we see regularly.

I'm sure I'm missing something here, can someone help me understand? Is it just the "Ick" factor of having something you thought was encrypted actually being fairly open?

I don't understand why this is getting more attention that other (seemingly) more dangerous exploits.

[1] - [http://msisac.cisecurity.org/advisories/2013/2013-088.cfm](http://msisac.cisecurity.org/advisories/2013/2013-088.cfm)

<comment><USER7> It's getting attention because:

\- It's an easy to spot bug,

\- in the most critical part of the code,

\- of a fundamental security library,

\- and it's been there for a long time, nobody knows how many systems have already been compromised due to it.

With this bug, Apple's library isn't actually a SSL implementation. It does not perform the most essential part of a SSL implementation - verifying that the peer possesses the private key it claims to posses.

> it seems far less crucial than remote-code-execution

> I don't understand why this is getting more attention that other (seemingly) > more dangerous exploits.

Because it's the foundation for a heap of applications and services that were believed to be secure due to use of SSL. If you consider those, this is worse than any bug in any application. It's not just one application with a critical vulnerability - effectively, it's half (or whatmany) of all OSX and iOS apps with a critical vulnerability. All you need to do is go browse the net in a coffee shop, and some stranger can easily do things like:

\- Pwn your box (MITM the auto update). Actually with this he can do all of the latter too.

\- Steal your money (MITM your bank connection).

\- Steam your online accounts, including email.

It's not "just a bug". Yes, everyone makes mistakes, we're all human. But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users.

> That's certainly a problem, but most people are using trustworthy ISPs

Your argument seems to be that it's not a big issue if the security is totally broke since we don't need security in the first place.

<comment><USER8> > "It's not "just a bug". Yes, everyone makes mistakes, we're all human. But > it's completely unacceptable that those mistakes get unnoticed and into > production code of such a critical component, and deployed to millions of > users."

This is not a reasonable argument. At Pwn2Own each year, how many browsers have vulnerabilities that allow remote code execution? All of them. How many of these vulnerabilities are zero-days? A significant number of those. This happens every single year. Even the advanced protections in e.g. Chrome don't stop new vulnerabilities from being found on a regular basis. And all of these products are deployed to millions of users.

You could complain about Apple's response to this bug, and that might be a reasonable complaint to make. At least Google patches bugs quickly when they surface at Pwn2Own. But that's different from claiming the bugs shouldn't have existed (or should have been caught before making it into production). Bugs are fundamentally hard to find, and it's not really getting any easier.

<comment><USER9> While it's true that almost all software has bugs that can result in exploits, I think most of the exploits used in Pwn2Own are typically the result of complex interactions between subsystems that are hard to predict. As software gets more complex, the attack surface increases.

The Apple bug isn't really in that class of exploit. It's a simple coding/merge error, and it's actually a regression from previously working code. One of the things that worries me is that this bug would have been caught so easily with basic unit tests.

        Test 1: Make connection to server with a valid SSL certificate [PASSED]
        Test 2: Make connection to a server with an invalid SSL certificate [FAILED]

Are we meant to think that Apple's build process doesn't use unit testing? Seems unlikely. Or perhaps this component didn't warrant an extensive test suite? I hope not! Not really sure what the explanation is.

I mean, I certainly can't claim that all my code is run through extensive tests before every deploy, but then I'm not working on the security tools that underpin an entire operating system.

<comment><USER10> In this case, the very test you're describing would not have worked. For a better writeup, see agl's post[1] on the matter. The basic gist of it: On affected systems, the server may use _any_ combination of private key and certificate. Most SSL libraries used on the server side will make sure the moduli of cert and private key match (and abort if this isn't the case). Unit testing would thus require a server with some modifications to its SSL library (OpenSSL, in most cases).

What would have caught the bug: automatic code indentation or any sort of compile-time warnings about dead code.

[1] [https://www.imperialviolet.org/2014/02/22/applebug.html](https://www.imperialviolet.org/2014/02/22/applebug.html)

<comment><USER9> I see what you mean, the amount of work and foresight needed to predict the bug and write a test for it does seem unrealistic in that light. Hingdsight is 20/20, etc.

</comment></comment></comment></comment></comment></comment><comment><USER11> Ahh, so they probably had to restart the QA on the whole release a few days ago (including FaceTime Audio and associated features) after adding the TLS fix at the last minute.

It makes a bit more sense why they'd make us wait a few days, now.

<comment><USER12> Its totally unacceptable. Even Microsoft does patches of this severity in less than 24 hours.

I suspect what this points to is that Apple doesn't have automated testing and they need a bunch of old school "hands on keyboards testers" to run a test case list that takes 4 days.

<comment><USER13> The parent 'suspects' and doesn't actually know. It's not 'totally unacceptable' either. It's over a weekend and it's a set of trade offs about cutting a release made by a bunch of smart engineers who were probably very tired (last week for them has probably sucked) and they've just pulled a long weekend to get this out the door.

If you find this 'totally unacceptable', my suggestion would be to either go join them and help them improve the situation or to move to another OS. Bitching on the internet merely indicates how little experience you have with the trade offs that need to be made when pushing latge volumes of software.

<comment><USER11> > my suggestion would be to either go join them and help them improve the > situation

Uhh no, we're customers. I don't find it unacceptable but if I did, it's within my rights to say so without "help[ing] them" as I pay the Apple Tax happily and repeatedly.

</comment></comment></comment></comment><comment><USER14> This should really have been a separate fix & installed without user interaction. Instead this is 450 Megs & requires a restart. It'll take days for it to get out to those at risk.

<comment><USER11> > This should really have been a separate fix & installed without user > interaction

Considering it needs to update the TLS support on the rescue partition too, doing it outside of single-user mode is probably not a good idea.

You're nitpicking, it seems.

<comment><USER15> Actually, that's a good point - I suspect testing the wacky double update could have added a day or so to QA

</comment></comment></comment><comment><USER16> The fun thing to think about is whether or not you can guarantee that the update you receive is actually from Apple and not someone sending you a fake via MITM.

Sure, they show a SHA1 on this page: [http://support.apple.com/kb/DL1726](http://support.apple.com/kb/DL1726) but that could be MITM'd as well.

<comment><USER17> Updates are signed and the OS will refuse to run them if signature verification fails, so unless your MITM has Apple's signing key that wouldn't work.

(And no, this bug didn't break client-side signed package verification.)

<comment><USER7> Unless your box has already been pwnd and the update installer has been modified to not install that update in the way it was meant to be.

<comment><USER17> Yes, if we assume you're already fucked, then we can conclude that there is nothing you can do to verify anything and that you are fucked, because we have assumed our conclusion. SHA1s and MD5s are equally pointless in this case because you've already assumed you're fucked, so it should all be assumed to be lying to you.

If, however, we don't engage in circular reasoning and we assume your box isn't currently in the possession of the Russian mafia or (insert preferred APT here), then how can one be reasonably confident that the update one receives through the updater is legitimately the one Apple is distributing?

Because it is signed and the code-signing verification was not broken by this bug.

<comment><USER18> _If, however, we don 't engage in circular reasoning_

I agree with the point you're making, but you can also turn this idea around, after which it serves to highlight how insanely inadequate our current tools and infrastructure are from a security standpoint.

Basically, you can only reasonably hope to verify a patch if you're not already owned, so you also have to assume you're not in order to verify. It's as if there was a contagious disease that has a good chance of killing you after a number of years, but the diagnostic tests can only be counted on to work if you don't have the disease in the first place. So then why would anyone ever bother getting tested? Our current situation is that uncomfortable.

<comment><USER17> > Basically, you can only reasonably hope to verify a patch if you're not > already owned, so you also have to assume you're not in order to verify. > It's as if there was a contagious disease that has a good chance of killing > you after a number of years, but the diagnostic tests can only be counted on > to work if you don't have the disease in the first place. So then why would > anyone ever bother getting tested? Our current situation is that > uncomfortable.

Being owned is less like having a virus and more like having schizophrenia. You can't ever expect to self-verify yourself, because if you're suffering from it, everything you're perceiving is being filtered through a compromised and untrustworthy system.

You have to trust some third-party that you believe to not be similarly compromised to do the verification for you.

<comment><USER18> _You have to trust some third-party that you believe to not be similarly compromised to do the verification for you._

Which effectively means that most people won't bother, unless a "trusted third party" is built into their machine.

But that has huge potential problems of its own.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> > The release notes, however, do not make mention of the SSL security bug that > was squashed on iOS late last week.

<comment><USER20> If anyone from Apple is reading and can influence this - could you convince whomever needs to be convinced that you ought to have less vague/shitty release notes, particularly wrt issues like this?

<comment><USER21> They cover security issues in a separate announcement (listed on [http://support.apple.com/kb/HT1222](http://support.apple.com/kb/HT1222)), but only a few hours after the update has been released. I do think high-impact security issues like this SSL bug deserve a mention in the release notes as well.

<comment><USER22> Looks like they're just trying to not make it obvious that Macs can have security problems. I don't think many regular users (who probably think Macs are invincible) are going to actively look for security announcements about their invincible Mac. And when they look at the release notes, many of them won't be convinced to stop what they're doing and install some unnecessary updates.

(Not trashing Mac, I am a Mac user.)

<comment><USER23> I wonder if their hope is everything transitions to something like iOS before this is falsified in a widespread way on OSX in public.

In corporate settings with desktop management, Macs are actually a huge pain to deal with; Windows maybe starts from crappier defaults but there's a much more mature industry around locking it down.

<comment><USER24> Hence why you want to be the odd one out with a Mac at Corporates: IT leaves you alone and you can manage it yourself.

<comment><USER25> If you really want IT to leave you alone you need a GNU/Linux machine.

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> >> • Adds call waiting support for FaceTime audio and video calls

Cool. Someday I'd like to be able to leave a FaceTime voicemail message if the receiver declines the FaceTime call.

<comment><USER27> Surely this would be facemail, not voicemail. :)

</comment></comment><comment><USER28> Damn, I was close… :-)

[http://i.imgur.com/vKnXhJ8.png](http://i.imgur.com/vKnXhJ8.png)

<comment><USER29> Isn't yours just a manifestation of the general TLS bug? Or does it differ somehow?

<comment><USER28> No, it's just a bug of the SecureTransport backend in curl [1]. I thought Apple maintains the backend as nobody else uses it (homebrew curl uses OpenSSL) and that's why I've submitted the issue to Apple instead to the curl maintainer.

So maybe it brought some eyes on the "gotofail" but that's just speculation…

Thanks anonymous Apple guy :)

[1] [https://github.com/bagder/curl/pull/93/files](https://github.com/bagder/curl/pull/93/files)

</comment></comment></comment><comment><USER30> I cant believe they don't even mention the SSL bug in this. That's just insulting.

<comment><USER31> It's mentioned in the last line here [http://support.apple.com/kb/HT6114](http://support.apple.com/kb/HT6114) And yeah, that's kind of bizarre.

<comment><USER30> Nice call. Yea very strange. Seems like the most important thing in this update. It should at least be at the top of the bug fix list.

</comment></comment></comment><comment><USER32> Apple has also changed the behavior of the power button on notebooks. Previously, pressing the button made the Mac instantly go to sleep. Now, just pressing it doesn't do anything. You can still hold the power button for 3 seconds to get the usual "Are you sure you want to shut down your computer now?" dialog box.

Awesome for those of us using FileVault who have to enter their login password each time they wake up their computer.

<comment><USER33> This changed back when 10.9 was released:

[http://support.apple.com/kb/HT5869](http://support.apple.com/kb/HT5869)

<comment><USER34> The parent is correct. In 10.9, pressing the power button put the computer to sleep, replacing the dialog prompt shown in your link. As of 10.9.2, simply pressing it does nothing at all.

</comment></comment></comment><comment><USER35> Interesting: After the update, ocspd downloaded roughly 40MB of ... certificate revocation lists?

ocspd /usr/sbin/ocspd Total: 196 B sent, 45.8 MB received Outgoing to devimages.apple.com (22.214.171.124), Port http (80), Protocol TCP (6), 196 B sent, 45.8 MB received

<comment><USER36> I think that's not related to the SSL/TLS bug, but instead to the curl problem that also came with the update to 10.9.2. This is the description from Apple's security mailing list:

"curl Available for: OS X Mavericks 10.9 and 10.9.1 Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information Description: When using curl to connect to an HTTPS URL containing an IP address, the IP address was not validated against the certificate. This issue does not affect systems prior to OS X Mavericks v10.9. CVE-ID CVE-2014-1263 : Roland Moriz of Moriz GmbH"

</comment></comment><comment><USER37> To all those who say "it was so easy to spot", congrats on finding the flaw and letting us all know first thing. /s

</comment><comment> brown9-2 What about non-Mavericks versions of OS X?

<comment><USER38> 10.8 and earlier are not vulnerable.

</comment></comment><comment><USER39> A compelling way to get holdouts to upgrade iOS/OSX. Get those iPhone 4 folks who are content with iOS 6.x to install iOS 7.x.

God only knows what incompetence and disregard for user privacy and sanity awaits in these "new" versions. What are they adding that we really need? Oh, the ability to use SSL PKI. Yeah, I guess you have to upgrade.

Why isn't HN discussing the effects this screw up has on email? Email is bigger than the web, belive it or not.

And most of the world appears to use webmail.

With this "bug" HTTPS for your webmail is futile.

You have no way to know you are connecting to the real googlemail, yahoomail, hotmail, etc.

The "authentication" functions of SSL need to be made an compilation option, not a default.

It's obvious almost no knows or cares how to use SSL's PKI mechanism properly.

SSL's encryption capabilities have been useful, but using SSL to do server authentication causes more problems than it solves.

History has shown it's just not easy enough to use.

SSH can do authentication without PKI. Alas, it is embedded into a program that only nerds use.

I'm using the authentication framework in CurveCP. I'm working on making it very easy to use.

<comment><USER40> Don't be a ignorant. Together with 7.0.6 there was also a security update to iOS 6.1.6.

[http://support.apple.com/kb/HT6146](http://support.apple.com/kb/HT6146)

</comment></comment><comment><USER41> confirmed here as well, it's fixed

[https://gotofail.com](https://gotofail.com)

</comment><comment><USER42> In 10.9.2. Apple did also fix a sadly impressive number of other security- related bugs:

[http://support.apple.com/kb/HT6150](http://support.apple.com/kb/HT6150)

</comment><comment><USER43> What I wonder, is if Apple can be held responsible (to some extent) for damages that resulted due to this bug for app developers like a bank whose customers were robbed because the bank relied on the secure connection as it should have been provided by the Apple API. Clearly, the attacker is still the person to have exploited the bug but I think a developer should be able to assume that Apples security relevant API functionalities are indeed secure.

<comment><USER44> Remember that software license you clicked while installing ? Most likely it had something like:

THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

So yeah Apple can't be held responsible. If they could then the whole free software open source community would be in deep doo doo.

</comment></comment><comment><USER45>
      PHP
      Available for:  OS X Lion v10.7.5, OS X Lion Server v10.7.5,
      OS X Mountain Lion v10.8.5, OS X Mavericks 10.9 and 10.9.1
      Impact:  Multiple vulnerabilities in PHP
      Description:  Multiple vulnerabilities existed in PHP, the most
      serious of which may have led to arbitrary code execution <…>

Didn't know it's in Mac OS X… But yeah, it is… /usr/bin/php

<comment><USER46> Oddly enough, the release notes states they upgraded to "5.4.22"... but "/usr/bin/php -v" gives "5.4.24" here.

</comment></comment><comment><USER47> Hope it also fixes the "issue" where my 2013 Macbook Pro reboots when it wakes up from sleep if there's a USB drive attached.

<comment><USER48> Mine grey screens when I have my usb hub plugged in at startup (doesn't get to partition selection).

Android file transfer utility stops the keyboard and touchpad from working.

<comment><USER49> I've got a similar USB issue. I have a SATA HDD in an External USB 3.0 enclosure. When my 2011 iMac wakes from sleep, it needs to wait for the external drive to spin up. Major PITA.

</comment></comment></comment><comment><USER50> _edit_ \- oh wow I just read what this fix's. Will be updating asap

I haven't upgraded to Mavericks at all yet because I'm worried that it will break software I depend on a daily basis. Can some please confirm if upgrading has a significant risk of breaking compatibility with things like rails, mamp, netbeans, android studio, golang, vagrant, virtualbox, docker etc.

Thanks

</comment><comment><USER51> So are they going to release this fix for Snow Leopard ? Not all of us are on the latest and greatest hardware.

<comment><USER44> The issue only effects OS X Mavericks.

</comment></comment><comment><USER52> Is it possible to manually verify the code signature with Apple's built-in public key before installing?

<comment><USER53> I would hope the built-in software-upgrade process does exactly that (independent of transport-layer SSL), but I have no evidence either way.

The manual-download pages on [http://support.apple.com/downloads/](http://support.apple.com/downloads/) publish SHA1 sums. Unfortunately those pages aren't served over SSL. You could download the update and compare its hash against those of your friends: at least then you'd all be installing the same thing (preventing narrowly- targetted attacks).

<comment><USER54> The Apple site [http://support.apple.com/kb/DL1726](http://support.apple.com/kb/DL1726) reports

      c06a63982b522e43997a05cedc04b0bdb1a10207

which matches my download using `shasum -a OSXUpdCombo10.9.2.dmg`

</comment></comment></comment><comment><USER55> Does it fix the networking stack also? Please dear god let it fix the networking stack. ([https://discussions.apple.com/thread/5551686?start=0&tstart=...](https://discussions.apple.com/thread/5551686?start=0&tstart=0))

<comment><USER56> Yes, this should be fixed in 10.9.2.

<comment><USER55> Any proof or reference? I'd prefer not to wait about 23 days for my server to explode.

</comment></comment></comment><comment><USER46> Finally.

Unfortunately we'll probably always be in the dark about the HOW, WHO and WHY. :(

<comment><USER57> Of course.

If it was an honest mistake, they're not going to publically throw an employee under the bus.

If it was a malicious action from the NSA, they're not allowed to make it public.

I suspect the only hypothetical way we'd hear about the "who" is if an employee weakened it for his own personal gain, and criminal charges were raised.

</comment></comment><comment><USER58> I have not read much in regards to _WHY_ this exact same bug was also found in OSX. Can anyone shed some light on this?

Do they use the same code stack for iOS and OSX? This seems weird to me - <USER2> though parts of code could be used in both operating systems, I would imagine separate teams would be on iOS and OSX, each reviewing code bases on their own, running unit tests and whatnot. Still, this major flaw has been present for 2.5(?) years - all the more reason for paranoia about its presence.

Add to this, why wait so long with the OSX update? A security issue THIS serious MUST be patched instantly and rolled out as an individual/separate update as soon as possible, even if that means pushing back OSX 10.9.2. Or did they need some time to introduce a new flaw somewhere? o_O

</comment><comment><USER23> I'm confused -- the osx dev center doesn't have 10.9.2 at all (any build), only the original October 10.9 release. I guess that happens whenever they push a new release?

<comment><USER59> Developer preview builds are now pushed out the Mac App Store.

See the Dev center for the instructions to set it up.

</comment></comment><comment><USER60> No sign of 4k@60Hz on the rMBP for the 32" Dell then?

</comment><comment><USER61> Its fixed

</comment><comment><USER62> Yeah. Finally they fixed this ssl bug and also important to me this annoying webcam bug on Macbook Air for Skype and Hangouts.

</comment><comment><USER63> I hope for a iOS 7.1 beta soon with this fix.

<comment><USER64> iOS was already patched a couple of days ago with iOS 7.0.6

<comment><USER63> Yes, they fixed the 7.0.X branch, but the 7.1 beta branch is still unfixed.

</comment></comment></comment><comment><USER65> Well, the bugs I reported in Finder are still there and it still crashes. I am very much missing Snow Leopard.

</comment><comment><USER66> But will this fix the bug where my mail doesn't update for hours at a time?!!

</comment><comment><USER67> Just installed this. Now I get a HSTS error on github for both Chrome and Safari.

<comment><USER68> I do too. Did you find any more details on this?

<comment><USER68> to fix it I had to reset my Keychain. Pain in the ass, but it was preventing me from working.

To do this, open Keychain Access, open Preferences, and click Reset Keychain. It will create a new login keychain and keep your old one backed up in the keychains folder.

<comment><USER67> I use digicert for my own company, and I had some old certificates in the key chain. Deleting those solved the problem.

</comment></comment></comment></comment><comment><USER69> OS X Mavericks audio problems are still not fixed. Audio dropouts in Google Chrome more often than once per second when a lot of tabs are open. Makes for example Youtube unbearable to watch. Chrome audio worked fine in OSX 10.8 with a lot more tabs.

Mid 2012 MBP (MacBookPro9,2).

<comment><USER70> Are you sure it's not a chrome bug? Obviously chrome updated itself many times in the meantime. Do you see this same bug even in different contexts (eg when using multiple applications, when doing CPU-intensive tasks and using iTunes at the same time, etc.)?

<comment><USER69> The bug does not show up immediately with light load in Chrome (only a few tabs open). But anything heavier, and audio dropouts start. No idea whether it's a Chrome bug or OSX, but the problem started immediately after 10.9 update.

The issue is present after a fresh reboot with no other applications running than Chrome.

My Chrome version is now 33.0.1750.117, which should be the current one.

iTunes and Safari audio output is always fine.

I run VMWare Fusion 6 virtual machines often, but that doesn't seem affect the bug way or another. Also, I only installed VF6 long after updating to 10.9.

Audio in Windows or Linux Chrome running in a VF6 virtual machine is perfectly good.

Just tested again, the issue seems to only affect Chrome playing Macromedia Flash content. I don't have Flash player installed, only Chrome's internal PPAPI Flash player.

</comment></comment></comment><comment><USER71> At last fixed SSL bug at OSX Mavericks 10.9.2

</comment><comment><USER72> Still no handling for hidpi and dell 2815Q

</comment><comment><USER73> i wonder how soon a metasploit plugin will be available?

</comment><comment><USER74> took me 4 reboots and 15minutes of waiting at something do with SD cards to get this crap installed. Even windows update works better these days.

</comment><comment><USER75> How many more backdoors will be discovered?

</comment><comment><USER76> I'm still not upgrading to Mavericks. I have a lot of work to do, and I dislike being asked to upend my system on somebody else's schedule.

<comment><USER77> If you don't run Mavericks you're not affected by the goto fail.

<comment><USER76> Yep, I know. As discussed a couple of days ago.

I think I'm just bothered by my perception that this Mavericks upgrade is being presented as a fix for an OS X security issue, rather than just offering a patch to Mavericks users.

<comment><USER44> My guess is that the time to get the 10.9.2 release out the door was less then it would have taken to get a seperate patch done.</comment></comment></comment></comment>


Review our Startup BusFeed - <AUTHOR> http://busfeed.com

<comment><USER2> The body text is styled very differently on the home page and the other pages, you should normalize this. That said, the former is too big and light, and the latter is too small. You also have schizophrenic paragraph styling. Some are separated by blank lines, some aren't, some are separated by two or three blank lines.

Your capabilities page needs screenshots, the more the better. Ubuntu may have a design worth stealing shamelessly for this: <http://www.ubuntu.com/netbook/features> . The screenshots are big enough that you can tell what's going on, but not so big that they overwhelm the page. (In previous iterations, they were even better, because they cranked up the font sizes before taking screencaptures, but...)

The pitch on your front page is also... remarkably nebulous. Change is here! But I still don't know what exactly you do. I think 37signals does a good job at this sort of thing (<http://highrisehq.com/>), you could check that out.

Best of luck.

<comment><AUTHOR> Great feedback, thanks

</comment></comment><comment><AUTHOR> We founded Busfeed.com as a web application for sales professionals.

BusFeed is a Sales 2.0 application, We harvest Business and Social network intelligence to help sales people get closer to their prospect and help close deals faster.

To get a Free 30 days subscription, Please use Promo code: BF_30DAYS_YC

We appreciate your feedback.

</comment><comment><USER3> I think you would benefit from having a more prominent call to action button. In this case, the link to the contact form to schedule a demo could be made more prominent.

<comment><AUTHOR> Good feedback thanks.</comment></comment>


Microsoft waves $300k at hackers, says 'do your worst' to Azure Security Lab - <AUTHOR> https://devclass.com/2019/08/06/microsoft-waves-300000-at-hackers-says-do-your-worst-to-azure-security-lab/ <comment><USER2> It's a marketing trick.

They might pay 300k, but the PR and coverage they get after an action like this worth millions</comment>


How our personal information is shared between companies and the government - <AUTHOR> http://www.aclu.org/files/pdfs/privacy/dataeco_full.pdf

<comment><USER2> There has got to be a more readable way to display this information.</comment>


The Big Mac Index - <AUTHOR> http://www.economist.com/content/big-mac-index <comment><USER2> This is essentially how inflation is calculated. Instead of just a big mac, an entire basket of predetermined everyday items and services are watched for changes and the fluctuation in prices are averaged for a domestic locale giving us the consumer price index. Then the numbers of the previous CPI are compared to the current.

Also, some people have taken to using the "iPod index" or really any uniform product that is widely available and standardized.

<comment><USER3> Interesting. Is there an existing standard for what everyday goods are used in determining inflation? I understand the usefulness of a "quick 'n dirty" gauge like this big mac index (or the iPod index you mentioned), but I'd be surprised if there isn't some standard set of goods which are watched as general indicators of inflation.

<comment><USER4> Its pretty obvious if you read a CPI report yourself.

[http://www.bls.gov/cpi/cpid1505.pdf](http://www.bls.gov/cpi/cpid1505.pdf)

Page 6 has the list and the weights of all goods per category. Housing is 42% of the CPI index, for example. Urban consumers vs Rural consumers are combined together, but the later tables split them out again.

People generally only talk about the single CPI number as an indicator in inflation. But a lot of work (and tables) go into that number.

<comment><USER5> Additionally, depending on what you're trying to measure, there are a variety of different sorts of ways to adjust for inflation. The CPI is a measure of consumer prices, and used by the Fed as a target for inflation in order to maintain price stability, but there are others: [http://www.measuringworth.com/uscompare/](http://www.measuringworth.com/uscompare/)

The CPI is flawed, of course, like any attempt to turn 300 million peoples' worth of purchases into a single number. The Federal Reserve itself thinks that it's a little bit on the high side, not doing enough to adjust for the changes that occur when better products are introduced or when people change their purchasing behavior (e.g. switching to generic products): [http://www.frbsf.org/economic- research/publications/economic...](http://www.frbsf.org/economic- research/publications/economic-letter/1997/may/bias-in-the-cpi-roughly-right- or-precisely-wrong/)

> _a lot of work (and tables) go into that number._

Economics is a whole _field_ of study.

<comment><USER6> > The CPI is flawed, of course, like any attempt to turn 300 million peoples' > worth of purchases into a single number.

The CPI doesn't even in theory try to do that, which is why it includes CPI-U, CPI-W, and C-CPI-U, each of which is tracked raw and seasonally adjusted, and each of which contains numerous measures (not a single number), the most frequently used of which seem to be the "all items", "all items less food and energy", "food", "energy", and "gasoline" components. (And all of which relate to US _urban consumers_ \-- for CPI-U and C-CPI-U -- or a subset thereof -- for CPI-W -- which are less than 300 million people.)

</comment></comment></comment></comment></comment><comment><USER7> The World Bank publishes PPP conversion factors: [http://data.worldbank.org/indicator/PA.NUS.PPPC.RF](http://data.worldbank.org/indicator/PA.NUS.PPPC.RF) "It tells how many dollars are needed to buy a dollar's worth of goods in the country as compared to the United States."

I prefer this to absolute numbers as the absolute number fluctuates with the exchange rate.

</comment><comment><USER8> Totally OT, but Ghostery had a hernia on this page.

       ADARA Analytics
       Detected tracker source URLs:
       http://tag.yieldoptimizer.com/ps/ps?t=s&p=1814&pg=Page
       http://tag.yieldoptimizer.com/ps/ps?t=s&p=1814&pg=Page
       BlueKai
       Brightcove
       DoubleClick
       DoubleClick Floodlight
       Effective Measure
       Facebook Connect
       Google AdWords Conversion
       Google AJAX Search API
       Google+ Platform
       Grapeshot
       LinkedIn Widgets
       Maxymiser
       Omniture (Adobe Analytics)
       Polar Mobile
       Quantcast
       Sub2
       Tapad
       Tealium
       TRUSTe Notice
       Turn Inc.
       Twitter Button
       ValueClick Media

<comment><USER9> Web of cruft.

</comment></comment><comment><USER10> What a difference a year makes. Brazil had the most overvalued currency in the world a year ago[1] according to the Big Mac Index, but today it's undervalued by 10.6%.

It strikes me that currency exchange rate is a very inconspicuous thing with a big effect. Unlike inflation, interest rates, or how much rent you pay--which everyone is aware of--most people don't sense changes in exchange rate, the effect of which is just as profound.

[1] [http://brazilsense.com/index.php?title=Items_more_expensive_...](http://brazilsense.com/index.php?title=Items_more_expensive_and_less_expensive_in_Brazil).

<comment><USER11> McDonald's in Brazil targets a customer base very different from MacDonald's in other countries. In the US, McDonald's is cheap fast food; in Brazil its stores appeared first in posher shopping malls. The local alternative (xis) is a lot cheaper, so pricing probably has a lot to do with market segmentation, which would render such comparisons useless.

<comment><USER12> Brazilian here and I can attest to this.

In the U.S, I only go to McDonald's if I'm alone and don't have an option( Chipotle is closed).

In Brazil, you'll see some families choosing it over local cuisine for 'modernity' or even 'sophistication'.

<comment><USER13> What? Where?

You're either talking about lower-lower middle class, or far outside the large metros, I presume?

I'm amazed no one mentioned Bob's Burgers, at any rate. Are you in the same Brazil I'm in?

<comment><USER14> Lower-income middles class can't afford R$15 burgers with the average (not median, which is much lower) household income per capita being ~R$1000/month. In practice, less than 20% of families make that much. With combos, 10 meals would account for 20% of pre-tax income.

Data is a couple years old, but still relevant: [https://sacrariopessoal.files.wordpress.com/2014/10/faixascm...](https://sacrariopessoal.files.wordpress.com/2014/10/faixascm20121.jpg)

</comment></comment></comment></comment></comment><comment><USER15> I'm actually using this data for some pricing decisions for online products that we sell.

I've actually made my own version that provides a bit more explanation and it targeted towards marketers and the likes [http://www.bigmacindexconverter.com/](http://www.bigmacindexconverter.com/)

</comment><comment><USER16> They appear to be using highcharts.js for the interactive graph (according to the mouseover event on the bars)

[http://www.highcharts.com/](http://www.highcharts.com/)

</comment><comment><USER17> I enjoy that they added the dataset for download this year, and some other changes. But the dataset's not available at the moment. And it's in .xls format when it should just be a csv.

</comment><comment><USER18> I love me some Big Mac indices. The concept is intriguing. I'd like to see the potato index or something non brand related. The trouble is choosing the right veggie/product

<comment><USER19> Is there another food item that is so ubiquitous? Some cultures don't eat rice. Some cultures don't eat potatoes. Some cultures don't eat corn. Some don't eat tofu. And for the many food items that are somewhat easy to find worldwide, demand will be different.

And is there another measuring stick that would give us the simultaneous jab against globalization and corporate imperialism?

<comment><USER20> Beer?

<comment><USER21> It needs to be consistent quality and non imported ideally.

Guiness for example is going to cost a lot to ship, or local beer could be very low quality in order to keep the price affordable.

<comment><USER22> Or just count the cheapest alcohol available

<comment><USER21> Again it will likley be imported from countries with lower labor costs.

You need something perishable, and of low enough cost that importing is unlikley.

Bread would be a good option but has the issue that it's not as common in Japan as France, it also varies wildley where as a big mac is generally consistent.

<comment><USER23> A Big Mac, as a branded item, varies by cultural context: in the US, it's super cheap fast food; in Europe it might be late-night after-party food; in Asia, an extravagant treat.

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> Well, I do not think brokers are eager to buy Venezuelan IT start-up shares just because Big Mac is most severely undervalued there.

<comment><USER25> Specially if you cannot freely convert VEB to any currency under any of the three (yes, three) official rates, unless you're a friend of the government.

<comment><USER5> Yeah, and the government can step in and seize your business if they feel like it: [http://blogs.wsj.com/frontiers/2015/02/04/venezuela- seizes-s...](http://blogs.wsj.com/frontiers/2015/02/04/venezuela-seizes- supermarket-chain-stores/)

You'll probably be fine with a small-time software business but you won't see anyone hurry to commit a bunch of cash to turn something into a $1B Venezuela unicorn...

</comment></comment></comment><comment><USER26> is it a good idea to group so much of the EU together? Some economies there are not as able to handle the single currency as others. Stronger states with better managed economies put more pressure on weaker economies with regards to borrowing costs and more.

<comment><USER27> I've heard this POV several times. If such a good idea why don't USA, China or India consider breaking regions into individual currencies. You never hear this.

I'm not saying this POV either right or wrong. Just Each of these other countries is 'Europe" or larger in their own right with distinct regional wealth differences. So why is this important for Europe and not other large diverse countries?

<comment><USER28> Europe is not a country. It does not have unified economic policy. If Europe started acting like a nation, and instituted a unified economic policy over the whole Euro-zone, then it would probably work just fine. However, there is no indication that will ever do that because all of the constituent countries like their sovereignty too much.</comment></comment></comment>


Ask HN: Is buying health insurance considered an In-App Purchase to Apple? - <AUTHOR> Hi all,
So I'm entertaining the idea of a (US-based) mobile health insurance broker, and given the topic has taken a lot of attention lately, figured I might ask since some of you are deeply knowledgeable in the topic of IAP.
My question is simple: I want to create a healthcare insurance flow into an iOS app. It'd ask the usual questions, give you a quote, and then offer you the option to purchase the insurance and pay premiums for it. Would Apple require you to take a 30% cut of the insurance premiums, and make it impossible to hand over to the web browser for purchase?
Healthcare is, as you all know, already a highly-regulated market with a set pricing model, which would make such a use case impossible.
Thanks in advance! <comment><USER2> The 30% IAP is only for digital services.

For real world services/products you can use Apple Pay for which they take somewhere around 2%.</comment>


Ask HN: To Beta Or Not To Beta? - <AUTHOR>

So, some background here about us:
We're a team of 4 people; 1 business/sorta-coder-guy (me) and 3 crazy-smart-programmers (not me). We are nearing the release of our first major mobile app release and are nailing down our beta strategy. Our app is consumer oriented, hyper local and fairly addictive to our current beta users.
The question is whether we should bother trying to do:
An exclusive beta where people ask to get on the list and get priority based on the number of other people they get to signup.
...or...
Just do an open beta and be done with it.
Now, I like the exclusive nature and the scarcity of a closed beta. One that does really well can even get a quite a few people signed up on our list whom we can all notify immediately when the app gets a full release. Conversely, we need lots of usage data to make our app the best it can be and limiting the number of users could hurt that effort.
With that said, we need to know the opinion of HN startups that have been there. What do you think? Did you do it before and would you recommend it again? Is there a reason you wouldn't again? Should we just do the closed beta and go open if not enough interest comes in? <comment><USER2> With your app it kind of sounds like you have a chicken / egg problem so you may want to just open it up to the most users possible so tat it is the "best it can be".

In the past we have tried both and I've found being more restrictive allows you to iron out things (most of the time unforeseen) before a full scale launch but you lack the large user base that you would get by just opening it up (Signup to be notified lists in my opinion and experience leave a lot of users out cold who don't come back).

In addition, larger betas can get you more traction quicker and also provide insight into new markets and uses for your app you never thought of while smaller betas on the other hand create a good core group of early adopters (because you can give them more attention) that if taken care of will help to champion your cause and spread word about your product.

</comment><comment><USER3> I think that unless you have an overall vision and reasons for running a closed beta, you should open it up. Forcing users to invite their friends for earlier access only works if your website has the capability to go viral. It's worked for the few companies who initially did it, but too many companies are jumping on this method, in my opinion.

If possible, I think the "best of both worlds" solution is to have an open beta, but encourage users to invite friends by offering something other then early access. I do this with my startup and it has helped get the word out.

<comment><AUTHOR> Thanks for the feedback - I've also been thinking of some kind of open beta with a kicker for users that get others to try it as well.</comment></comment>